Re: pxa crashes with qemu v5.2 when executing xscale operations

[Philippe Mathieu-Daudé]

On 12/21/20 6:28 AM, Guenter Roeck wrote:
> Hi,
> 
> I noticed that booting Linux on PXA emulations no longer works with qemu v5.2.
> When trying to boot akita, borzoi, or similar emulations, I get the following 
> crash.
> 
> [    0.965279] Internal error: Oops - undefined instruction: 0 [#1] PREEMPT 
> ARM
> [    0.967273] Modules linked in:
> [    0.967875] CPU: 0 PID: 1 Comm: swapper Not tainted 
> 5.10.2-rc1-00017-gc96cfd687a3f #1
> [    0.968101] Hardware name: SHARP Akita
> [    0.968676] PC is at xscale_cp0_init+0x84/0x114
> [    0.968815] LR is at do_one_initcall+0x60/0x290
> [    0.968997] pc : [<c08ce068>]    lr : [<c000a2dc>]    psr: 60000013
> [    0.969186] sp : c0bdfec8  ip : c0bdfee0  fp : c0bdfedc
> [    0.969332] r10: c08fe834  r9 : c09f2000  r8 : c08c6a9c
> [    0.969498] r7 : c09e0c00  r6 : 00000000  r5 : 00002041  r4 : 00002040
> [    0.969679] r3 : 00000100  r2 : 00000000  r1 : 69052000  r0 : 00000000
> [    0.969892] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment 
> none
> [    0.970123] Control: 00007977  Table: a22e0000  DAC: 00000071
> [    0.970349] Process swapper (pid: 1, stack limit = 0x(ptrval))
> [    0.970564] Stack: (0xc0bdfec8 to 0xc0be0000)
> [    0.970818] fec0:                   c08cdfe4 ffffe000 c0bdff4c c0bdfee0 
> c000a2dc c08cdff0
> [    0.971144] fee0: c004b8a0 c08c9458 c0bdfee4 00000000 00000dc0 00000000 
> 00000007 00000007
> [    0.971438] ff00: 00000000 c07fc180 c08c944c c08c6a9c c017213c c0c07c4c 
> c0c07c54 c092d028
> [    0.971728] ff20: 00000000 000000a0 c0c07c20 c092d028 c09293fc c0c07c20 
> 00000008 c08fe854
> [    0.972026] ff40: c0bdff94 c0bdff50 c08ca220 c000a288 00000007 00000007 
> 00000000 c08c944c
> [    0.972315] ff60: ffffe000 000000a0 c0bdff8c 00000000 c0671de8 00000000 
> 00000000 00000000
> [    0.972603] ff80: 00000000 00000000 c0bdffac c0bdff98 c0671e00 c08ca0d8 
> 00000000 c0671de8
> [    0.972891] ffa0: 00000000 c0bdffb0 c0008360 c0671df4 00000000 00000000 
> 00000000 00000000
> [    0.973199] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 
> 00000000 00000000
> [    0.973488] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 
> 00000000 00000000
> [    0.973763] Backtrace:
> [    0.974001] [<c08cdfe4>] (xscale_cp0_init) from [<c000a2dc>] 
> (do_one_initcall+0x60/0x290)
> [    0.974282]  r5:ffffe000 r4:c08cdfe4
> [    0.974564] [<c000a27c>] (do_one_initcall) from [<c08ca220>] 
> (kernel_init_freeable+0x154/0x1dc)
> [    0.974791]  r7:c08fe854 r6:00000008 r5:c0c07c20 r4:c09293fc
> [    0.974948] [<c08ca0cc>] (kernel_init_freeable) from [<c0671e00>] 
> (kernel_init+0x18/0x110)
> [    0.975191]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 
> r5:c0671de8
> [    0.975394]  r4:00000000
> [    0.975476] [<c0671de8>] (kernel_init) from [<c0008360>] 
> (ret_from_fork+0x14/0x34)
> [    0.975695] Exception stack(0xc0bdffb0 to 0xc0bdfff8)
> [    0.975885] ffa0:                                     00000000 00000000 
> 00000000 00000000
> [    0.976184] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 
> 00000000 00000000
> [    0.976458] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000
> [    0.976657]  r5:c0671de8 r4:00000000
> [    0.976961] Code: e1a03003 e24ff004 e3a02000 e3a03c01 (ec432000)
> 
> The code is:
> 
>   70: ee1f3f11        mrc     15, 0, r3, cr15, cr1, {0}
>   74: e1a03003        mov     r3, r3
>   78: e24ff004        sub     pc, pc, #4
>   7c: e3a02000        mov     r2, #0
>   80: e3a03c01        mov     r3, #256        ; 0x100
>   84: ec432000        mar     acc0, r2, r3
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> This is supposed to be a DSP or iWMMXt coprocessor instruction.
> I did notice that the code to support xscale instructions has changed 
> significantly
> in qemu v5.2.

Indeed a lot changed...

I had a quick look. The instruction is decoded in aa32 as LDR_ri.

Without looking at the spec, I simply googled the instruction and
got this link:
https://developer.arm.com/documentation/ddi0406/c/Application-Level-Architecture/ARM-Instruction-Set-Encoding/Load-store-word-and-unsigned-byte
which is for ARMv7-[AR] so I tried this dumb diff to skip the
LDR_ri decoding:

-- >8 --
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -6562,6 +6562,10 @@ static bool op_load_ri(DisasContext *s,
arg_ldst_ri *a,
     ISSInfo issinfo = make_issinfo(s, a->rt, a->p, a->w);
     TCGv_i32 addr, tmp;

+    if (!ENABLE_ARCH_7) {
+        return false;
+    }
+
     addr = op_addr_ri_pre(s, a);

     tmp = tcg_temp_new_i32();
@@ -6583,6 +6587,10 @@ static bool op_store_ri(DisasContext *s,
arg_ldst_ri *a,
     ISSInfo issinfo = make_issinfo(s, a->rt, a->p, a->w) | ISSIsWrite;
     TCGv_i32 addr, tmp;

+    if (!ENABLE_ARCH_7) {
+        return false;
+    }
+
     addr = op_addr_ri_pre(s, a);

     tmp = load_reg(s, a->rt);
---

Then realized disas_xscale_insn() isn't reached. In case that helped,
I focused on these commits:

590057d969a ("target/arm: Simplify disas_arm_insn")
19c23a9baaf ("target/arm: Separate decode from handling of coproc insns")
7b4f933db86 ("target/arm: Pull handling of XScale insns out of
disas_coproc_insn()")

> Does this mean that there is a bug, that the affected emulations are no longer
> supported, that I now have to specify some new option on the qemu command 
> line,
> or something else ?

The command line is likely correct, all the pxa270* CPUs have the same
architectural features. It is not yet listed as "no longer supported"
but certainly "not enough tested". Good news, you seem to have an easy
reproducible test.

> 
> Thanks,
> Guenter
>